Trojan download win32.trojdownloader.delf.114688 virus behavior:
The virus is a trojan download, which downloads other viruses from the Internet to the client's machine and runs it. The virus runs the epigenetic derivation of a DLL file into the system directory.
1. Generate Files
%windir%\system32\downdll.dll
2. Modify the Registration Form
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Savedlegacysettings = hex:3c, 00,00,00,06,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,20,94,af,51,08,a1 , c7,01,01,00,00,00,c0,a8,1c,f4,00,00,00,00,00,00,00,00,
Hkey_current_user\software\microsoft\windows\currentversion\ext\stats\{fb5f1910-f110-11d2-bb9e-00c04f795683}\ IExplore
Count = dword:00000005
Hkey_current_user\software\microsoft\windows\currentversion\ext\stats\{fb5f1910-f110-11d2-bb9e-00c04f795683}\ IExplore
Time = hex:d7,07,08,00,04,00,10,00,06,00,19,00,38,00,9b,00,
3. Create a IEXPLORE.EXE process after virus runs.
4. Save from Http://www.*****.cn/images/js/az.exe download virus file to c: Packing directory.
5. Generate a Delme.bat file under C:\Windows\system32 to delete the source file.
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.
